How we look after your data
The plain version. The legal text is in the privacy policy.
Where it lives
On servers in the European Union: Railway's europe-west4 region, in the Netherlands. The service checks this itself on every deployment and raises an alarm if it ever changes. Railway is a US company.
Who else handles the data
Every provider that touches the data, what it sees and when. This list is the application's own: if the code ever calls a service that isn't here, our tests stop the deployment.
- Railway (USA), servers in Amsterdam (Netherlands): hosting for the application and the database: accounts, forms and answers. When: always.
- OpenRouter (USA), routes to AI model providers outside the EU: the sentence you use to ask for a form and, if you ask for an analysis, that form's answers. When: only when you use the AI, with zero retention: nothing is kept or used for training.
- Notion (USA), the form creator's Notion workspace: that form's answers, as pages in their database. When: only if the form's creator connects their Notion.
- Migadu (Switzerland), Switzerland: the emails the application sends: account recovery, meeting notices, alerts and confirmations to respondents. When: when an email is sent.
- Google (Drive) (USA), the company's Google Drive storage: a daily copy of the database, encrypted before it leaves: Google stores it but cannot read it. When: once a day.
What the AI writes, marked
Everything AIM FORM's AI writes is shown as such («AI-generated», «The AI's reading», «The AI created this draft»).
Each reading, each analysis and each draft from the no-account tool also carries a machine-readable mark: an attestation signed with Ed25519, with the
date, the model and the SHA-256 fingerprint of the text, in the data-ai-provenance attribute. The public
key is at /.well-known/aimform-ia.json and anyone can check an attestation
at /ia/verificar. We don't hide invisible watermarks inside the text: they break screen readers and copy
and paste. We do this because of the transparency obligation in Article 50 of the EU AI Act.
What we store
If you create forms: your email, your password (only as a hash, never readable), your forms and their answers,
and where you came from when you signed up, only as a category (a form's badge, a search engine, an AI assistant),
to know what works. No cookies.
If you email a notice to your member roll: each member's email, only to send them their ballot and reminders; it's deleted with the vote.
If you answer a form: your answers and the date and time they arrive; if the form is anonymous, only the date.
We store neither your IP nor your browser identifier with your answer. To stop abuse, such as someone sending a
thousand answers, we count each connection's submissions for a while using a fingerprint of its IP (a hash,
not the IP), deleted within two days at most. We also count, in aggregate per day, how many people open the form,
start it and reach each question, so its creator can improve it: no cookies and nothing that identifies you (and
nothing at all if your browser has «Do Not Track» or Global Privacy Control on).
If you vote with a ballot code: that your ballot has been used, with no time, and your vote separately, with the
date but not the time, and nothing linking it to you. The organisers see how many ballots have been used, not which.
If you run a draw with our tool: the fingerprint of the list (never the names, which stay in your browser), how
many participants, winners and reserves, the title if you add one, the seed and the time, so anyone can check it.
If you ask a question in a talk: its text and its votes, with nothing that identifies you.
If you write to us or report abuse: what you write (and your email, if you give it), and for two days a
fingerprint of your IP, only to stop floods; then it's deleted.
If you ask the AI for questions without an account: the draft it suggests (not the sentence you write), for 48
hours, so you can keep it when you create your account or sign in; then it's deleted. And what each AI call cost,
with nothing linking it to you.
What we don't do
No tracking cookies, no third-party analytics, no advertising, no selling data. The usage figures we look at are aggregate counts (how many people opened a form today), never who did what.
When artificial intelligence is involved
Only when you ask for it. If you create a form with the AI (also from the tool with no account), the sentence you write is sent to an AI model provider through OpenRouter; if you ask the AI to analyse the answers, those answers are sent as well. These providers may process data outside the EU, and each request goes only to providers with zero retention: they keep nothing and don't train on it. If you never press those buttons, nothing is sent.
Copies
Every day, a copy inside our host (daily ones kept 6 days, plus weekly and monthly), and another one outside it, encrypted before it leaves, in the company's storage (the latest 30 are kept). Whoever stores it cannot open it; only we hold the key.
If your forms collect personal data
You are the controller and we are your processor (see the terms). The GDPR kit prepares for free, from each form, the information for respondents, the record of processing activities entry and the impact assessment analysis.
Your control
From My account you can download everything we have about you and delete your account completely, yourself and right away. If you answered someone's form, that person is responsible for it: write to them, or use “Report abuse” at the bottom of the form. For anything else, contact us.